files, you can look at /etc/tmpdirs.d/01_aaa_base from package
aaa_base for an example.

Doesn't that make the fastboot people cry? What about using a simple

IMO yes - since it is invoked at every time. That's why I recommend it as
"last resort" or add it only for files used by everybody.

configuration file format like in /etc/permissions and have a
while/read loop or a small C program do the actual job?
That would potentially also allow to natively integrate the feature
into other boot methods that don't rely on scripts.